#!/bin/bash

function color_message()
{ 
  case "$1" in
      "warn")
      echo -e "\e[1;31m$2\e[0m"
      ;;
      "info")
      echo -e "\e[1;33m$2\e[0m"
      ;;
  esac
}


Init_Install()
{
 Set_timezone
 Selinux_off
 Set_iptables
 Set_ssh
 Set_virtual
 Optimize_Performance
 Push_key
}

Set_timezone()
{
    \cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
    dmidecode -s system-product-name|awk '{if($1!~"VMware")exit 1}' || hwclock -w
    timedatectl set-timezone "Asia/Shanghai"

}


Set_virtual()
{
  virtual=`dmesg |grep -i virtual|grep input |wc -l`
  if [ $virtual = 0 ];then
    acolor_message  "info" "---- physical machine setting ----"
    hwclock -w # 将系统时钟同步到硬件时钟
    sed  -i '/bell-style/c set bell-style none' /etc/inputrc # 替换禁止滴滴声
    # dmidecode -s system-product-name|awk '{if($1!~"VMware")exit 1}' || hwclock -w
  else
    color_message  "info" "---- virtual machine setting  ----"
    # uuidgen ens
    sed  -i '/uuid/d'  /etc/sysconfig/network-scripts/ifcfg-eth0
    service  network restart
    

  fi
}



Selinux_off()
{
  color_message  "info" "---- close  selinux ----"
    if [ -s /etc/selinux/config ]; then
      setenforce 0
        sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
    fi
}

Set_iptables()
{
  color_message  "info"  "---- setup iptables ----"
  if [ ! -f /etc/sysconfig/iptables  ];then
    yum install  iptables-services -y
    chkconfig iptables on
    systemctl enable  iptables
    systemctl disable  firewalld
    systemctl stop  firewalld
    service iptables restart
  fi

  iptables -F
  iptables -X
  iptables -t nat -F
  iptables -t nat -X
  iptables-save
  service iptables save
}

Set_ssh()
{
    color_message  "info" "SSH优化"

    #sed  -i '/^#Port/c Port 6022'  /etc/ssh/sshd_config  &>/dev/null  # 默认端口修改
    grep '#UseDNS yes' /etc/ssh/sshd_config && sed -i "s/#UseDNS yes/UseDNS no/g" /etc/ssh/sshd_config 
    grep '#AuthorizedKeysFile'  /etc/ssh/sshd_config && sed -i "s/#AuthorizedKeysFile/AuthorizedKeysFile/"  /etc/ssh/sshd_config
    grep 'GSSAPIAuthentication yes' /etc/ssh/sshd_config && sed -i "s/GSSAPIAuthentication yes/GSSAPIAuthentication no/g" /etc/ssh/sshd_config
    service sshd restart # sshd服务重启
} 

Push_key ()


{
        adduser super
        sudo su - super -c 'mkdir -p /home/super/.ssh'
        sudo echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7bguGgUjaeTLY1EO69yXpHjKi+PnRtbbgE4YenOqv9ZPD9YI/DLks81HXNb0E+g3dSRDKh3cFjyc8bWln601bigvynaLWIBG3GCGHYunvP8JkKUw1eXV+vfskQhRyJnBKCKcHG0syNu2t3eNtAlhRBq/vEYLdf5JaA6wrBwwL+FZpUOoIcD5DtVnAmz/COUitG4D6i+PTX6SX8gz0+Vfv3OT1kWnEvvCa2k662bwMJMJtlt4l0W3O/5iGAKdz/kvcrawqJnIMCN4EIswgibOgGtHLctmCDlZIoDNuOroQ+wEzfAJSgNhAsQUDZC4Saur5CFWXoW7fPM/5yQLWNrMt root@ops-base"> /home/super/.ssh/authorized_keys

    chown super.super /home/super/.ssh/authorized_keys
        chmod 700 /home/super/.ssh ;chmod 600 /home/super/.ssh/authorized_keys


(grep "super" -lr /etc/sudoers)||cat >> /etc/sudoers << EOF
super ALL=(ALL) NOPASSWD: ALL
Defaults:super !requiretty
EOF


useradd xidian
        su - xidian -c 'mkdir -p /home/xidian/.ssh'
        su - xidian -c "echo >/home/xidian/.ssh/authorized_keys"
        echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWX0z3BbdBFh+znkr0cONc/uqTlaAWOzIf+U3yz/dlOKPyauRq7mJHw9h/Xdua5iOpDwmLf+HvtFy8bFV7MV7WuwRcUPnkInLbBCMs6TDtis7foZ9DnV2UyQCkol8SUvkugthRW1PeDwHnf60zrOpymsvz6qIZfcb5HtjHemSCn66VNacbbtwZPlOIW6lLZmwzUdIZLh7gOgoKHvkdGvQyaT4Fjzdn7B2FYiGBHq2UCn95S8oaRWh2Jcy8+KsPycSqGzLAgHmpXzeZwRmuZrLEXEXu6OIHxWNphAvASFQBfm9D59N560Pd0SSqbyJzk2mgSSKi/t6Dlxz5ckCARAhf root@ops-base ">/home/xidian/.ssh/authorized_keys
        chmod 700 /home/xidian/.ssh ;chmod 600 /home/xidian/.ssh/authorized_keys

}


Optimize_Performance()
{
  color_message  "info"  "Performance optimize "

chmod +x /etc/rc.local ; grep ulimit  /etc/rc.local || echo ulimit -HSn 1048576 >>/etc/rc.local

grep 65535 /etc/sysctl.conf || cat > /etc/sysctl.conf<<EOF
fs.file-max = 9999999
# 所有进程最大的文件数
fs.nr_open = 9999999
# 单个进程可分配的最大文件数
fs.aio-max-nr = 1048576
# 1024K；同时可以拥有的的异步IO请求数目

fs.inotify.max_queued_events = 327679
fs.inotify.max_user_instances = 65535
fs.inotify.max_user_watches = 50000000
#

net.ipv4.ip_local_port_range = 9000 65000
# 被动端口

net.ipv4.tcp_keepalive_time = 180
# 客户端每次发送心跳的周期，默认值为7200s（2小时）；检测服务端是否活着
net.ipv4.tcp_keepalive_intvl = 15
# 探测包的发送间隔 默认75秒
net.ipv4.tcp_keepalive_probes = 5
# 没有接收到对方确认，继续发送保活探测包次数 默认9次

net.ipv4.tcp_tw_reuse = 1
#启用tcp重用
net.ipv4.tcp_fin_timeout = 3
# 决定FIN-WAIT-2状态的时间
net.ipv4.tcp_tw_recycle = 0
# TIME-WAIT的tcp快速回收；入口网关禁用此项


net.core.somaxconn = 4000
#监听队列的长度
net.netfilter.nf_conntrack_max = 262144
# 网络并发连接数等限制
net.nf_conntrack_max = 262144
# 网络并发连接数等限制

# vm.nr_hugepages=512 # 内核大页内存
# net.core.somaxconn = 65535 # 端口最大监听队列长度
# net.ipv4.tcp_max_syn_backlog  # SYN同步包的最大客户端数量

#net.ipv4.conf.all.send_redirects = 0
#net.ipv4.conf.default.send_redirects = 0
#禁止数据包重定向发送 (安全)
EOF

sysctl -p
}

Init_Install
